A .p7m file is a document wrapped in a CAdES digital signature, the CMS-based signature format specified by ETSI in EN 319 122. The original file, most often an XML invoice, sits inside the signed envelope with the signer's certificate, and the name keeps the original extension, as in invoice.xml.p7m. Italy's Sistema di Interscambio accepts CAdES-signed invoices in this form. Klarbon unwraps .p7m files in beta.
What is in a .p7m file?
| Property | Value |
|---|---|
| Standard | CAdES, ETSI EN 319 122-1, cited edition 1.3.1 of June 2023 |
| Syntax | CMS SignedData in ASN.1, DER or BER encoded |
| Content | the original document, attached inside the envelope |
| Also holds | one or more signatures and the signers' certificates |
| Typical name | name.xml.p7m for a signed XML invoice |
ETSI defines CAdES as a set of building blocks and baseline signatures on top of CMS (ETSI EN 319 122-1). The Italian rules accept two signature formats for e-invoices: CAdES-BES, which gives a .xml.p7m file, and XAdES-BES, which keeps the .xml name (SdI rules 1.8.1, in Italian). Invoices to Italian public bodies must be signed; see FatturaPA.
What does a signature prove?
A valid CAdES signature shows that the content has not changed since it was signed and which certificate signed it. Establishing certificate trust, revocation status and qualification at signing time requires separate checks; matching the signature to the content is not enough. Unwrapping a file is neither.
What does Klarbon do with .p7m files?
| Task | Status |
|---|---|
| Unwrap a .p7m file, including nested signatures | beta, in open an e-invoice |
| Show the invoice inside, if Klarbon can read its format | beta |
| Check supported RSA and ECDSA signatures against the content | beta; unsupported algorithms are reported |
| Check certificate trust, revocation or qualification | not yet |
Klarbon never signs documents and never asks for a private key. If you convert the invoice inside, the result is a new, unsigned document; keep the signed original.
Related
Frequently asked questions
What is a .p7m file?
A file wrapped in a CAdES digital signature. The original document, often an XML invoice, sits inside the signed envelope together with the signer's certificate. The name usually keeps the original extension, as in invoice.xml.p7m.
How do I open a .p7m file?
Unwrap it to get the original document back. Klarbon does this in beta and shows an Italian FPR12 invoice inside as a readable invoice. Signing software and some viewers from Italian certificate providers also open .p7m files.
How do I open a .p7m file on a Mac?
Use Klarbon's browser viewer for supported .p7m files, in beta. It unwraps the signed content and shows it when the enclosed invoice format is supported; it is not a full certificate-verification service.
Does opening a .p7m file prove the signature is valid?
Not fully. Klarbon checks supported RSA and ECDSA signatures against the content and reports when a signature cannot be checked. It does not check certificate trust, revocation or qualification; use a verifier that covers those checks.